CXSECURITY Database RSS Feed - CXSecurity.com

Laravel Socialite < 5.29.0 - Facebook OIDC Nonce Replay Authentication Bypass

Mohammed Idrees Banyamer — Fri, 21 Aug 2026 19:30:15 +0000

Topic: Laravel Socialite < 5.29.0 - Facebook OIDC Nonce Replay Authentication Bypass Risk: Medium Text:#!/usr/bin/env python3 # Exploit Title: Laravel Socialite < 5.29.0 - Facebook OIDC Nonce Replay Authentication Bypass # CVE: ...

WordPress Plugin WPZOOM Portfolio 1.4.21 Reflected Cross-Site Scripting (XSS)

Kent Apostol — Fri, 21 Aug 2026 19:29:30 +0000

Topic: WordPress Plugin WPZOOM Portfolio 1.4.21 Reflected Cross-Site Scripting (XSS) Risk: Low Text:# Exploit Title: WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS) # Date: June 10, 2026 # Exp...

WooCommerce 1.5.0 Unauthenticated Arbitrary File Upload

Mohammad Hossein Sadeghian — Fri, 21 Aug 2026 19:29:18 +0000

Topic: WooCommerce 1.5.0 Unauthenticated Arbitrary File Upload Risk: High Text:# Exploit Title: WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload # Google Dork: N/A # Date: 2026-07-15 # Exploit ...

PCMan 2.0.7 Buffer Overflow

Thiago Cunha — Fri, 21 Aug 2026 19:29:06 +0000

Topic: PCMan 2.0.7 Buffer Overflow Risk: High Text:# Exploit Title: PCMan FTP Server 2.0.7 - Buffer Overflow # Google Dork: [if applicable] # Date: 05/18/2025 # Exploit Author...

Joomla Extension 4.1.4 PHP Object injection

Amin İsayev — Wed, 12 Aug 2026 18:47:48 +0000

Topic: Joomla Extension 4.1.4 PHP Object injection Risk: High Text:Exploit Ttile: Joomla Extension 4.1.4 - PHP Object injection Affected : JoomShaper SP LMS < = 4.1.3 Fixed : JoomShaper SP ...

LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting

Mohammed Idrees Banyamer — Wed, 12 Aug 2026 18:46:48 +0000

Topic: LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting Risk: Low Text:#!/usr/bin/env python3 # Exploit Title: LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting # CVE: ...

strongSwan 5.9.13 DoS

Lukas Johannes Moeller — Wed, 12 Aug 2026 18:46:23 +0000

Topic: strongSwan 5.9.13 DoS Risk: Medium Text:# Exploit Title: strongSwan 5.9.13 - DoS # Date: 2026-05-13 # Exploit Author: Lukas Johannes Moeller # Vendor Homepage: http...

OrkesConductor 3.30.2 Unauthenticated Remote Code Execution

Mohammed Idrees Banyamer — Wed, 12 Aug 2026 18:45:28 +0000

Topic: OrkesConductor 3.30.2 Unauthenticated Remote Code Execution Risk: High Text:#!/usr/bin/env python3 # Exploit Title: OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution # CVE: ...

iOS Bluetooth PAN - Zero-Cost Ethernet Gateway (USB Port 62078)

Fares Dahoumane — Wed, 12 Aug 2026 18:45:04 +0000

Topic: iOS Bluetooth PAN - Zero-Cost Ethernet Gateway (USB Port 62078) Risk: High Text:# Exploit Title: iOS Bluetooth PAN - Zero-Cost Ethernet Gateway (USB Port 62078) # Date: 2026-06-23 # Exploit Author: Fares D...

Apache Gravitino 1.2.1 SSRF

Wed, 12 Aug 2026 18:44:38 +0000

Topic: Apache Gravitino 1.2.1 SSRF Risk: Medium Text:# Exploit Title: Apache Gravitino 1.2.1 - SSRF # Google Dork: N/A # Date: 2026-07-13 # Exploit Author: Ajay Rajpurohit # V...

MODX.3.2.1 TLS cookie without secure flag set - COOKIE PHPSESSID HIJACK

nu11secur1ty — Sun, 02 Aug 2026 15:18:08 +0000

Topic: MODX.3.2.1 TLS cookie without secure flag set - COOKIE PHPSESSID HIJACK Risk: Medium Text:# Titles: MODX.3.2.1 TLS cookie without secure flag set - COOKIE PHPSESSID HIJACK # Author: nu11secur1ty # Date: 7/7/2026 # ...

Linux Kernel 7.0-7.0.8 & 7.0-rc-7.0-rc7 - Use After Free Exploit

antonius — Sun, 02 Aug 2026 15:17:44 +0000

Topic: Linux Kernel 7.0-7.0.8 & 7.0-rc-7.0-rc7 - Use After Free Exploit Risk: High Text:CVE-2026-46215 Linux Kernel Use After Free Exploit - More Stable & Reliable for Linux 7.0-7.0.8 & 7.0-rc-7.0-rc7 Explo...

ArcadeDB < 26.7.2 Cross-Database Authorization Bypass (IDOR)

Mohammed Idrees Banyamer — Sun, 02 Aug 2026 15:16:52 +0000

Topic: ArcadeDB < 26.7.2 Cross-Database Authorization Bypass (IDOR) Risk: Low Text:#!/usr/bin/env python3 # Exploit Title: ArcadeDB < 26.7.2 Cross-Database Authorization Bypass (IDOR) # CVE: CVE-2026-67342 #...

Joomla Page Builder CK < = 3.5.10 - Unauthenticated Arbitrary File Upload (RCE)

M@rAz Ali,Peyman Siyahi,MR.PERSIA — Sun, 19 Jul 2026 09:36:19 +0000

Topic: Joomla Page Builder CK < = 3.5.10 - Unauthenticated Arbitrary File Upload (RCE) Risk: High Text:#!/usr/bin/env python3 # Exploit Title: Joomla Page Builder CK < = 3.5.10 - Unauthenticated Arbitrary File Upload (RCE) # Goog...

Microsoft Edge < = 150.0.4078.48 (Chromium-based) Type Confusion RCE

Mohammed Idrees Banyamer — Sun, 19 Jul 2026 09:35:56 +0000

Topic: Microsoft Edge < = 150.0.4078.48 (Chromium-based) Type Confusion RCE Risk: Medium Text:#!/usr/bin/env python3 # Exploit Title: Microsoft Edge < = 150.0.4078.48 (Chromium-based) Type Confusion RCE # CVE: ...

Linux Kernel 7.0 DRM UAF LPE Exploit

Antonius — Sun, 19 Jul 2026 09:35:28 +0000

Topic: Linux Kernel 7.0 DRM UAF LPE Exploit Risk: High Text:Exploit Repo : https://github.com/bluedragonsecurity/CVE-2026-46215-EXPLOIT This is and exploit for CVE-2026-46215 (Linu...

Langflow 1.3.0 Remote Code Execution

Diamorphine — Sun, 19 Jul 2026 09:34:58 +0000

Topic: Langflow 1.3.0 Remote Code Execution Risk: High Text:# Exploit Title: Langflow 1.3.0 - Remote Code Execution # Fofa-dork: title="Langflow" # Shodan-dork: title:"Langflow" # Da...

Krayin CRM v2.2.x Authenticated Remote Code Execution

Diamorphine — Sun, 19 Jul 2026 09:34:49 +0000

Topic: Krayin CRM v2.2.x Authenticated Remote Code Execution Risk: High Text:# Exploit Title: Krayin CRM v2.2.x - Authenticated Remote Code Execution # Date: 07/05/2026 # Exploit Author: Diamorphine ...

PraisonAI CodeAgent < = 1.6.77 Remote Code Execution (RCE) via Unsandboxed LLM Code Execution

Mohammed Idrees Banyamer — Sun, 19 Jul 2026 09:34:40 +0000

Topic: PraisonAI CodeAgent < = 1.6.77 Remote Code Execution (RCE) via Unsandboxed LLM Code Execution Risk: High Text:#!/usr/bin/env python3 # Exploit Title: PraisonAI CodeAgent < = 1.6.77 Remote Code Execution (RCE) via Unsandboxed LLM ...

XenForo XSS CVE Scanner — Passive Detection Tool for CVE-2026-35055, CVE-2026-35054, CVE-2026-35057

Xasthur — Fri, 03 Jul 2026 15:40:56 +0000

Topic: XenForo XSS CVE Scanner — Passive Detection Tool for CVE-2026-35055, CVE-2026-35054, CVE-2026-35057 Risk: Low Text:#!/usr/bin/env python3 """ XenForo XSS CVE Scanner Author: Xasthur Passive detection for CVE-2026-35055, CVE-2026-35054, ...

KNX visualisering - Broken Access Control

parsa rezaie khiabanloo — Fri, 03 Jul 2026 15:40:41 +0000

Topic: KNX visualisering - Broken Access Control Risk: Medium Text:# Exploit Title: KNX visualisering - Broken Access Control # Date: 6/13/2026 # Exploit Author: parsa rezaie khiabanloo # Ven...

7-Zip < = 26.02 - Mark-of-the-Web (MotW) Bypass via RAR5 Alternate Data Stream Name Collision

Mohammed Idrees Banyamer — Fri, 03 Jul 2026 15:40:05 +0000

Topic: 7-Zip < = 26.02 - Mark-of-the-Web (MotW) Bypass via RAR5 Alternate Data Stream Name Collision Risk: Medium Text:#!/usr/bin/env python3 # Exploit Title: 7-Zip < = 26.02 - Mark-of-the-Web (MotW) Bypass via RAR5 Alternate Data Stream N...

NodeBB < = 4.13.2 ActivityPub attributedTo Local UID Spoof

Mohammed Idrees Banyamer — Fri, 03 Jul 2026 15:39:53 +0000

Topic: NodeBB < = 4.13.2 ActivityPub attributedTo Local UID Spoof Risk: Medium Text:#!/usr/bin/env python3 # Exploit Title: NodeBB < = 4.13.2 ActivityPub attributedTo Local UID Spoof # CVE: ...

Mon, 22 Jun 2026 20:07:25 +0000

Topic: Risk: Low Text:...

KNX visualisering - Broken Access Control

parsa rezaie khiabanloo — Mon, 22 Jun 2026 20:07:15 +0000

Topic: KNX visualisering - Broken Access Control Risk: Medium Text:# Exploit Title: KNX visualisering - Broken Access Control # Date: 6/10/2026 # Exploit Author: parsa rezaie khiabanloo # Ven...

vm2 < = 3.11.3 - NodeVM Builtin Denylist Bypass

Mohammed Idrees Banyamer — Mon, 22 Jun 2026 20:06:49 +0000

Topic: vm2 < = 3.11.3 - NodeVM Builtin Denylist Bypass Risk: High Text:#!/usr/bin/env python3 # Exploit Title: vm2 < = 3.11.3 - NodeVM Builtin Denylist Bypass (Sandbox Escape) # CVE: ...

SiYuan < = 3.5.9 Remote Code Execution via Malicious Bazaar Package

Mohammed Idrees Banyamer — Mon, 22 Jun 2026 20:05:58 +0000

Topic: SiYuan < = 3.5.9 Remote Code Execution via Malicious Bazaar Package Risk: Low Text:#!/usr/bin/env python3 # Exploit Title: SiYuan < = 3.5.9 Remote Code Execution via Malicious Bazaar Package # CVE: ...

Windows Defender (MsMpEng.exe) Race Condition -> LPE / SYSTEM / Use-After-Free -> Crash

nu11secur1ty — Mon, 15 Jun 2026 15:31:20 +0000

Topic: Windows Defender (MsMpEng.exe) Race Condition -> LPE / SYSTEM / Use-After-Free -> Crash Risk: Medium Text:# Titles: Windows Defender (MsMpEng.exe) Race Condition -> LPE / SYSTEM / Use-After-Free -> Crash # Author: nu11secur1ty # Da...

D-Link DSL2600U rom-0 Admin Password Disclosure

Amir Hossein Jamshidi — Mon, 15 Jun 2026 15:31:09 +0000

Topic: D-Link DSL2600U rom-0 Admin Password Disclosure Risk: High Text:# Exploit Title: D-Link DSL2600U - 'rom-0' Admin Password Disclosure # Date: 2026-05-02 # Exploit Author: Amir Hossein Jamshi...

KNX visualisering - Broken Access Control

parsa rezaie khiabanloo — Mon, 15 Jun 2026 15:30:34 +0000

Topic: KNX visualisering - Broken Access Control Risk: Medium Text:# Exploit Title: KNX visualisering - Broken Access Control # Date: 6/10/2026 # Exploit Author: parsa rezaie khiabanloo # Ven...

PHP Link Directory (phpLD) 2.1.3 - SQL Injection, IDOR, CSRF

Xasthur — Mon, 15 Jun 2026 15:30:21 +0000

Topic: PHP Link Directory (phpLD) 2.1.3 - SQL Injection, IDOR, CSRF Risk: High Text:Title: PHP Link Directory (phpLD) 2.1.x Multiple Vulnerabilities Product: PHP Link Directory (phpLD) Vendor: N...

OpenEMR 7.0.2 Arbitrary File Read

doany1 — Mon, 15 Jun 2026 15:30:12 +0000

Topic: OpenEMR 7.0.2 Arbitrary File Read Risk: High Text:# Exploit Title: OpenEMR 7.0.2 - Arbitrary File Read # Google Dork: intitle:"OpenEMR" inurl:"interface/login/login.php" # D...

ZTE ZXHN H188A V6 Authentication Bypass

Mina Nageh Salalma — Mon, 15 Jun 2026 15:29:57 +0000

Topic: ZTE ZXHN H188A V6 Authentication Bypass Risk: Low Text:# Exploit Title: ZTE ZXHN H188A V6 - Authentication Bypass # Date: 2026-05-20 # Exploit Author: Mina Nageh Salalma (Monx Res...

phpLD 2.1.3 (EOL) has authenticated SQLi in admin/dir_validate.php (CATEGORY_ID) and admin ORDER BY (sort), unauthenticated IDO

Xasthur — Mon, 15 Jun 2026 15:29:41 +0000

Topic: phpLD 2.1.3 (EOL) has authenticated SQLi in admin/dir_validate.php (CATEGORY_ID) and admin ORDER BY (sort), unauthenticated IDO Risk: Medium Text:Title: PHP Link Directory (phpLD) 2.1.x Multiple Vulnerabilities Product: PHP Link Directory (phpLD) Vendor: N...

Tenable Terrascan Server < = v1.18.3 SSRF and Local File Read

Mohammed Idrees Banyamer — Sat, 06 Jun 2026 20:19:09 +0000

Topic: Tenable Terrascan Server < = v1.18.3 SSRF and Local File Read Risk: Medium Text:#!/usr/bin/env python3 # Exploit Title: Tenable Terrascan Server < = v1.18.3 SSRF and Local File Read # CVE: CVE-2026-47358 #...

Lenovo LegionSpace 1.7.11.2 DAService Unquoted Service Path

CENACIF-MX — Sat, 06 Jun 2026 20:18:33 +0000

Topic: Lenovo LegionSpace 1.7.11.2 DAService Unquoted Service Path Risk: Medium Text:# Exploit Title: Lenovo LegionSpace 1.7.11.2 - 'DAService' Unquoted Service Path # Exploit Author: CENACIF-MX # Discovery Dat...

ZTE H298A / H108N Unauthenticated Credential Exposure

Mina Nageh Salalma (Monx Research) — Sat, 06 Jun 2026 20:18:13 +0000

Topic: ZTE H298A / H108N Unauthenticated Credential Exposure Risk: Medium Text:# Exploit Title: ZTE H298A / H108N - Unauthenticated Credential Exposure via ETHCheat Parameter # Date: 2026-05-20 # Exploit...

WordPress Contest Gallery 28.1.4 Unauthenticated Blind SQL Injection

cardosource — Sat, 06 Jun 2026 20:17:59 +0000

Topic: WordPress Contest Gallery 28.1.4 Unauthenticated Blind SQL Injection Risk: Medium Text:# Exploit Title: WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection # Google Dork: N/A # Date: 2026-06-0...

BrandIT Consultancy - Blind Sql Injection

behrouz mansoori — Sat, 06 Jun 2026 20:17:46 +0000

Topic: BrandIT Consultancy - Blind Sql Injection Risk: Medium Text:********************************************************* #Exploit Title: BrandIT Consultancy - Blind Sql Injection #Date: 20...

Association Management Script - Multiple Vulnerabilities (IDOR, SQLi, Stored XSS)

Xasthur — Sat, 06 Jun 2026 20:17:24 +0000

Topic: Association Management Script - Multiple Vulnerabilities (IDOR, SQLi, Stored XSS) Risk: High Text:# Exploit Title: Association Web Script - Multiple Vulnerabilities # Date: 06.06.2026 # Author: Xasthur # Contact: https://t...